A new feature to fix DRUPAL-PSA-2016-003 security issue.

Notify on site status report page if insecure webforms are found. Webforms should be considered insecure if anonymous users are allowed to submit files using public scheme.

CommentFileSizeAuthor
#7 warn_admin_users_on-2816405-7.patch3.96 KBvinmassaro
#5 webform-security_report-2816405-5.patch1.65 KBilari.stenroth
#2 webform-security_report-2816405-2.patch1.49 KBilari.stenroth
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

ilari.stenroth created an issue. See original summary.

ilari.stenroth’s picture

ilari.stenroth CreditAttribution: ilari.stenroth at Exove commented
Status: Active » Needs review
FileSize
webform-security_report-2816405-2.patch1.49 KB

Here's a patch to implement the feature.

ilari.stenroth’s picture

ilari.stenroth CreditAttribution: ilari.stenroth at Exove commented
Parent issue: » #2816121: [meta] Is there anything webform can do to mitigate PSA-2016-003?
ilari.stenroth’s picture

ilari.stenroth CreditAttribution: ilari.stenroth at Exove commented
Title: Warn admin users on site status report page if insecure webfors are found » Warn admin users on site status report page if insecure webforms are found
ilari.stenroth’s picture

ilari.stenroth CreditAttribution: ilari.stenroth at Exove commented
FileSize
webform-security_report-2816405-5.patch1.65 KB

New revision of the patch. Now counts correctly insecure webforms.

vinmassaro’s picture

vinmassaro CreditAttribution: vinmassaro commented

@ilari.stenroth: thanks for this patch - I'm modifying it slightly to add links to the problem webforms. New patch coming shortly.

vinmassaro’s picture

vinmassaro CreditAttribution: vinmassaro commented
FileSize
warn_admin_users_on-2816405-7.patch3.96 KB

Here is a new patch that combines my additions with the patch from #5. It adds a list of problem webforms with links to each so they can be more easily edited. This is very helpful for a site with a lot of webforms.

DanChadwick’s picture

DanChadwick CreditAttribution: DanChadwick commented
Status: Needs review » Needs work

Difficulties with this approach:
1) There may well be authenticated-but-untrusted users.
2) Webform API functions alter submission creation and edit access, making it difficult or impossible to know if a particular user can upload a file and is also untrusted.
3) Some sites have a huge number of webforms, which will cause this to time-out.